Kiloview P1/P2 vulnerabilities
10 vulnerabilities
Known vulnerabilities in Kiloview P1/P2, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2023-41921kiloview · p1/p2Download of Code Without Integrity Check in Kiloview P1/P2 devicesA vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.EPSS0.25%MediumCVE-2023-41927kiloview · p1/p2Weak TLS Cipher Suites Supported in Kiloview P1/P2 devicesThe server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses.EPSS0.13%MediumCVE-2023-41928kiloview · p1/p2Remote server offers deprecated TLS protocol in Kiloview P1/P2 devicesThe device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses.EPSS0.13%CriticalCVE-2023-41917kiloview · p1/p2Improper input validation in Kiloview P1/P2 devices allows for remote code executionInadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.EPSS0.71%CriticalCVE-2023-41918kiloview · p1/p2Missing Authentication for Critical Function in Kiloview P1/P2 devicesA vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.EPSS0.57%CriticalCVE-2023-41920kiloview · p1/p2Authentication Bypass by Primary Weakness in Kiloview P1/P2 devicesThe vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.EPSS0.42%CriticalCVE-2023-41919kiloview · p1_firmware +2 moreUse of Hard-coded Credentials in Kiloview P1/P2 devicesHardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.EPSS0.42%HighCVE-2023-41926kiloview · p1/p2Insufficiently protected credentials in Kiloview P1/P2 devicesThe webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.EPSS0.26%HighCVE-2023-41923kiloview · p1/p2Weak Password Requirements in Kiloview P1/P2 devicesThe user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.EPSS0.27%HighCVE-2023-41922kiloview · p1_firmware +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devicesA 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored XSS attacks to occur. Multiple areas within the administration interface of the webserver lack adequate input validation, resulting in multiple instances of Stored XSS vulnerabilities.EPSS0.24%